United States of America: Passed Maryland Kids Code for Data Protection of Children's Online Data (SB0571)

On 14 March 2024, the Senate passed the Consumer Protection - Online Products and Services - Data of Children (Maryland Kids Code) Act. The Act mandates that any entity in scope offering an online product likely to be accessed by children must complete a data protection impact assessment by 1 April 2026. Entities in scope include limited liability companies, corporations, associations, or other legal entities that are operated for shareholders' profit, collect customers' personal information, and either have an annual gross revenue of USD 25 million, get in contact with personal information with at least 50'000 customers a year, or derive minimum 50% of its annual revenue from the sale of customer data. The mandatory data protection impact assessment should identify the purpose of the online product, how the online product uses children's data, and determine whether the online product is designed in the best interest of the child. Entities violating the bill's requirements may face civil penalties of USD 2'500 per affected child for each negligent violation and USD 7'500 per affected child for each intentional violation. The Senate's amendments affect the definitions and also require algorithms used by online products to include a description of the steps the covered entity has taken to comply with the Act.